Detecting Phishing Campaigns Behind Fresh, Authenticated Domains

A phishing operation can register a new domain, configure DKIM and DMARC correctly, and still use the domain to impersonate a bank, government agency, supplier, or employer. This lets attackers pass basic authentication checks while the domain has not yet developed a negative reputation.

For Australian organisations, the lure may resemble an ATO notice, a myGov alert, an Australia Post delivery update, or a message from a familiar bank. The branding can look polished, and the sending domain may have valid records. Authentication proves that the sender controls the domain; it does not prove that the sender is trustworthy.

The practical task is to combine technical evidence with context. Domain age, registration details, redirect behaviour, message wording, URL destinations, and sending patterns can reveal a campaign that reputation filters have not yet learned to recognise.

Why New Domains Slip Through

Reputation systems need history. A newly registered domain can begin with a neutral score because it has no previous abuse, complaints, or suspicious traffic. Attackers exploit this clean starting point by sending low volumes first, then increasing delivery after testing which messages reach inboxes.

A valid DMARC policy can make the operation appear technically mature. If SPF or DKIM aligns with the visible From address, the message may pass DMARC even though the domain is fraudulent. The correct interpretation is that the email passed an ownership and alignment check, not that it came from a legitimate organisation.

Inspect Authentication Correctly

Review the Authentication-Results header rather than relying on a logo or a security badge in the email. Check whether SPF passed for the actual sending service, whether DKIM passed using a credible signing domain, and whether both aligned with the visible From domain under DMARC.

Pay attention to differences between the From, Return-Path, DKIM d= value, and envelope sender. A campaign may use a fresh domain with valid DMARC while linking to another host, collecting credentials through a third-party form, or using a lookalike subdomain. A missing SPF record is a separate weakness; these SPF configuration basics explain why it can make a domain easier to abuse.

Trace Infrastructure And Redirects

Examine every link without opening it in a normal browser session. Expand shortened URLs, inspect the final hostname, and compare the visible link text with the actual destination. A newly registered domain may redirect through several compromised sites or tracking services before reaching a convincing login page.

Redirects can conceal the original infrastructure from scanners and analysts. They may also send Australian visitors to a different page from users elsewhere, depending on location, device, or time. Detailed guidance on redirect chain analysis can help expose this layered behaviour.

Assess Message And Targeting

Look for urgency, payment changes, unexpected document sharing, account suspension warnings, and requests for one-time codes. A message claiming that an ATO refund, Medicare matter, or myGov account needs immediate action deserves independent verification, especially when it asks for credentials or identity documents.

Language can provide useful clues in Australia. Fake messages may imitate local spelling but use awkward phrases, unusual references to “postcodes” or “BSB details”, or pressure recipients to act outside normal business processes. Compare the email with previous notices from the organisation and contact it using a phone number or website found independently.

Check Domain Context At Scale

Investigate the domain’s registration date, registrar, name servers, hosting provider, certificate history, and related domains. A domain created days before a campaign, sharing infrastructure with other suspicious names, should receive additional scrutiny even when its DNS records are correctly configured.

Security teams reviewing supplier lists or customer records can use bulk domain checking to identify recently changed authentication, missing records, and clusters of unusual domains. This is useful for Australian businesses managing large CRM databases across multiple brands, franchises, or .au and international domains.

Contain The Campaign Safely

Preserve the original message, complete headers, attachments, URLs, timestamps, and relevant mail-server logs. Do not forward a suspicious email as an attachment to colleagues without warning, since links or tracking elements may remain active. Store copies in a controlled investigation system.

Block the domain, URL, sender infrastructure, and related indicators where appropriate, but avoid relying on a single domain name. Attackers can abandon a name quickly and register another. Update filtering rules for the campaign’s themes, redirect patterns, lookalike naming, and targeted business processes.

Compare Signals Before Trusting

A reliable assessment weighs authentication against reputation, behaviour, and business context. The following comparison helps distinguish a legitimate new sender from a newly established phishing operation.

Signal	More consistent with a legitimate sender	More consistent with phishing
Domain age	Established history and stable ownership	Registered shortly before the campaign
DMARC	Aligned with known organisational infrastructure	Valid, but unrelated to the claimed brand
Links	Lead to familiar, consistent domains	Redirect through several unrelated hosts
Message request	Matches an expected workflow	Creates urgency or requests secrets
Hosting	Stable infrastructure with credible contacts	Shared with suspicious or rapidly changing domains
Recipient targeting	Relevant relationship and normal timing	Broad, unexpected or highly pressured targeting

A new domain with valid DMARC should therefore be treated as authenticated, not automatically safe. Combining sender reputation checks, DNS analysis, URL inspection, and awareness of local impersonation themes gives organisations a stronger way to identify campaigns before employees or customers hand over information.